INFORMATION GOVERNANCE & COMPLIANCE

Size: px

Start display at page:

Download "INFORMATION GOVERNANCE & COMPLIANCE"

Abraham McBride
6 years ago
Views:

1 INFORMATION GOVERNANCE & COMPLIANCE 1 1 Tools and Strategies for Effectively & Efficiently Managing Big Data in the Face of Complex & Constantly Evolving Compliance Challenges October 9, 2013 M. James Daley, Esq., CIPP/US Laura Clark Fey, Esq., CIPP/US

2 The Excitement Builds. 2

3 Agenda 3 Introduction Key Challenges Posed by Big Data How Strong Information Governance Programs Can Help Organizations Manage Compliance Challenges Core Tools and Strategies Conclusion

4 4 4 PART I: INTRODUCTION Challenges posed by Big (and Getting Bigger) Data: Is Your Organization Ready for the Zettaflood of Data, Devices, and Users?

6 Technology is Evolving Rapidly 6

7 Organizations are Utilizing Increasing Modes of Communication and Data Storage Devices 7 Smart phones ipads Laptops Social media Shared data portals

8 More Organizations Allowing Employees to BYOD 8 In 2012, approximately 71% of companies surveyed said they supported and/or tolerated BYOD IT Groups typically underestimate percentage of employees using their own devices for company business by 50% By 2014, estimated number of connected devices per employee: 3.3

9 The Impact of Evolving Technologies 9

10 Data Explosion 10 Every minute of the day: Apple receives around 47,000 App downloads 571 new websites are created Facebook users share 684,478 pieces of content Twitter users send over 1,00,000 tweets Google receives over 2,00,000 search queries

11 We Produce Exabytes of Data Every Day More data crosses the internet every second than was stored in the entire internet just 20 years ago 11

12 Overall Amounts of Data will Only Continue to Increase 12 4X LARGER INTERNET DATA WILL BE IN 2016 THAN IT WAS IN 2011

13 Correspondingly, Organizational Data Volume is Increasing 13 90% of the data in the world has been created in the past two years For most organizations, data volume doubles every months Storage of that data consumes about 10% of a typical firm s IT budget a trend that's projected to reach 40% by 2014

15 15 15 PART II Key Challenges Posed by Big Data

16 Biggest Challenges 16 What are the biggest records governance challenges facing your company today?

17 Big Data Challenges 17 C-Level Executives Biggest Data Management Gripes: Don t have the right systems in place to gather the information we need (38%) Can t give our business managers access to the information they need; need to rely on IT (36%) Systems are not designed to meet the specific needs of our industry (29%) Can t make sense of the information we have and translate it into actionable insight (25%) Information is no longer timely by the time it makes it to our business managers (24%)

18 18 BackRub BackRub Search I m Feeling Lucky Make BackRub my homepage

19 Big Data Challenges 19 Management of data becomes more difficult as more data is being generated, retrieved, and stored by more people in more locations.around the globe As data grows in volume, increases in variety, and moves with greater velocity, the capabilities required to govern it must increase exponentially Challenging to address the complexity that arises from different types of data (e.g., blogs, Wikis, and social media)

rise Typical Corporate Records Collection Approx.

20 Decreasing Value/Increasing Risks with Old Data 20 Over time, the value of information declines, while the associated costs remain constant and risks rise Typical Corporate Records Collection Approx. 69% of remaining data is Data Debris Legal Holds: 1% Regulatory retention: 5% Current business value: 25%

21 Challenges with Aging Data 21 As data ages, it becomes increasingly difficult and expensive to find, process, restore, and review: Inability to locate information within different silos Decommissioning of the technology to access or restore it Difficulty understanding the nature of it without first restoring it Absence of any context for understanding it after it is restored

22 Bottom Line: Most Businesses Are Not Prepared 22 60% of executives rate their companies unprepared to leverage data; cite significant gaps in people, process, and tools 97% say they need to make changes to improve 93% of the executives believe they are losing revenue at an average rate of 14% annually

23 Legal Challenges 23 Multiple and increasing areas of risk In a world where: Technology is rapidly changing Organizational data is exploding Laws, regulations, and rules governing data retention, preservation, and protection are rapidly expanding

24 Overview of Key Legal Challenges 24 Protecting Intellectual Property and Trade Secrets Meeting Legal Hold and E-Discovery Obligations Complying with Records Retention Requirements Addressing U.S. and International Data Protection and Privacy Obligations Meeting Ethical Obligations

25 What Can be Done? 25

26 26 26 PART III How Strong Information Governance Programs Can Help Organizations Manage Those Compliance Challenges

27 What is Information Governance? 27 Information Governance is the practice of putting in place measures (people, processes, and tools) to mitigate risk Information Governance is: Dynamic Proactive Collaborative Focused on enabling the business to get its work done Focused management of records and information throughout the entire information lifecycle

28 Information Governance Framework 28 Records Management Traditionally focused on paper or imaged Records at the back-end Typically limited to: Records Management Policy Records Retention Schedules Records Management Procedures (SOP s) Records Management software Records discovery support Active file center maintenance Inactive records storage and disposition Enterprise Information Governance focuses on Records and Information throughout the entire information lifecycle and consists of much more, including but not limited to: Code of Conduct Employee on-boarding and off-boarding Vendor management Legal, technical and administrative policies, procedures and processes Training and compliance monitoring Technology solutions

29 Core Goals of Information Governance Programs Reasonable Preservation of Data Required for Legal and Business Reasons 29 Accurate and Consistent Information Controls that Deliver the Right Information at the Right Time Cost-Effective, Legally Defensible Management of Legal Holds, E-Discovery, and Regulatory Risks Protection of Confidential Data Defensible Disposition of Unnecessary Data

30 30 30 MANAGING COMPLIANCE CHALLENGES Through Implementation of a Strong Information Governance Program

31 Initiate Information Governance Program 31

32 Develop a Framework, Policies, and Procedures to Manage Significant Areas of Legal Risk 32 Prepare litigation and regulatory profile Collaborate with colleagues in IT, HR, and other business units Conduct gap analysis to identify areas of opportunity for risk and cost reduction with respect to current legal, technical and administrative policies, processes and procedures for managing data

33 Develop a Framework, Policies, and Procedures to Manage Significant Areas of Legal Risk 33 Prepare risk/cost matrix Developed phased plan for addressing areas of risk Identify roles for legal, compliance, IT, HR, and other business units

34 Develop a Framework, Policies, and Procedures to Manage Significant Areas of Legal Risk 34 Design framework to enhance collaboration and communication between Legal, IT and other business units Engage decision-makers and influencers and obtain buy-in for proposed plan Begin implementing plan, and update and revise as necessary

35 Anticipated Benefits after Implementation of Good Information Governance Program 35 Increase in effectiveness, productivity, and response times Enhanced compliance with regulatory and other requirements Increased efficiency and confidence when responding to litigation and audit demands

36 Defensibly Dispose of Data No Longer Needed for Business or Legal Reasons 36 Why is it important? Limiting data retention moving forward Disposing of old data

37 Implement Repeatable and Legally Defensible Legal Hold and E-Discovery Procedures 37 Why is it important? Legal Hold Procedures E-Discovery Processes

38 Implement Process for Meeting Records Retention Requirements 38 Why is it important? Identifying Records Retention Requirements Implementing Retention Schedule

39 Enhance Compliance with Data Protection and Privacy Obligations 39 Why is it important? Applicable requirements Best practices

40 40 40 PART IV: SELECT TOOLS & STRATEGIES Utilizing Information Governance to Address Big Data s Compliance Challenges

1. Intelligent Legacy Data Review Process Inventory legacy data and legal holds 41 Select statistically valid sample of legacy data Identify random sample of legal hold custodians Index and

41 1. Intelligent Legacy Data Review Process Inventory legacy data and legal holds 41 Select statistically valid sample of legacy data Identify random sample of legal hold custodians Index and search legacy data using keywords and concepts Identify legacy data relevant to existing legal holds Validate retention of relevant legacy data Disposition Plan Assess/cull remaining content

42 Legacy Data Review Process: Detail Develop accurate inventory of legacy data 42 Identify current legal holds, records schedules and legal hold custodians Identify statistically valid random sample of legal hold custodians Develop Boolean and Bayesian (concept based) searches tailored to type of data

43 Legacy Data Review Process: Detail If possible, use available information to select statistically valid sample of legacy data Alternatively, identify statistically valid sample of legacy data via limited processing 43 Index and search legacy data using relevant terms and concepts via Boolean and Bayesian search tools (not just keywords or phrases)

44 Legacy Data Review Process: Detail Identify legacy data that relates to existing legal holds and records retention schedules Export statistically valid sample of relevant legacy data into Relativity review tool Validate that sample legacy data is being preserved in non-legacy ESI systems and data Provide disposition recommendations 44

45 Legacy Data Review Process: Detail Develop legacy data disposition plan Execute disposition plan through assessment and culling of remaining content and: Retain, or Map to existing legal holds and record retention schedule obligations Document disposition of legacy data and provide legal opinion as to reasonableness 45

46 Legacy Data Review Case Studies 46 Global Entertainment Company 100,000 legacy media Located in data centers and offsite facilities worldwide No catalogs, indices or drives 2,500 media restored, indexed and searched for legal holds 500 legacy media remain, with more dropping off each year

47 Legacy Data Review Case Studies 47 Global Pharma & Medical Device Company 65,000 legacy media No catalogs, indices or drives Inventory reduced to 8,000, with additional reductions each year Significant storage and e-discovery cost and risk reduction

48 Legacy Data Review Best Practices 48 Identify and designate legacy data that is Not Reasonably Accessible due to burden and cost Seize your window of opportunity to reduce existing Legacy Data inventory, and obtain Top Level Management Support for a Legacy Data Review Project

49 Legacy Data Review Best Practices 49 Going Forward, Use Disaster Recovery only for Disasters Establish and Enforce Global Enterprise Backup Retention Policies Conduct Annual Legacy Media Policy Compliance Review

50 Improving Communication, Training, and Awareness 50 Why is it important? Recommended approaches Monitoring compliance

51 Selecting and Implementing Technology Solutions to Address Key Areas of Legal Risk 51 Why are they important? What technology solutions are organizations utilizing, and for what purposes? Key factors in selecting and implementing technology solutions

52 52 52 CONCLUSION

53 Anticipated Future Trends in Information Governance 53 Increased Use of Predictive Coding in e-discovery and Information Governance Continued Expansion of Data Privacy Obligations/ Privacy by Design More Data Privacy and E-Discovery Issues in the Cloud

56 M. James Jim Daley How to Contact Us 56 Direct: (913) Mobile: (913) Laura Clark Fey Direct: (913) Mobile: (816) Please use the communication method that works best for you.

Why CIP? AIIM International's Certified Information Professional designation was designed to allow information professionals to:

Why CIP? AIIM International's Certified Information Professional designation was designed to allow information professionals to: Why CIP? Over the past decade, there has been a perfect storm of change driven by consumerization, cloud, mobile, and the Internet of Things. It has changed how we think about enterprise information and